CVE-2023-43498

Vulnerability

Description

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, the processing of file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files [1]. This behavior does not adequately restrict access to these temporary files, potentially exposing them to other users or processes on the system.

Exploitation

Conditions

An attacker must have access to the Jenkins controller file system to exploit this vulnerability. With such access, the attacker can read or write the temporary files before they are processed or moved to their intended location [1]. No authentication is required beyond the ability to access the file system.

Impact

Successful exploitation could lead to information disclosure if sensitive data in the uploaded files is read, or arbitrary file write if the attacker modifies the temporary files before they are used. This could compromise the integrity or confidentiality of the Jenkins instance.

Mitigation

The issue is addressed in Jenkins 2.424 and LTS 2.414.2, as announced in the Jenkins Security Advisory 2023-09-20 [2][3]. Users are advised to upgrade to these versions or apply any available workarounds recommended by the vendor.